What is the CVSS score of CVE-2026-1591?

CVE-2026-1591 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Pdf Editor Cloud are affected by CVE-2026-1591?

CVE-2026-1591 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 6.3. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

How to fix or mitigate CVE-2026-1591?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Pdf Editor Cloud CVE-2026-1591

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-02-03 14984358-7092-470d-8f34-ade47a7658a2

XSS Pdf Editor Cloud

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 03, 2026 - 08:16 nvd

MEDIUM 6.3

DescriptionCVE.org

Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload file list without proper escaping, allowing arbitrary JavaScript execution when the list is displayed.

This issue affects pdfonline.foxit.com: before 2026‑02‑03.

AnalysisAI

Foxit PDF Editor Cloud contains a stored XSS vulnerability in its file upload functionality where malicious usernames are not properly sanitized before being displayed in the upload file list, enabling authenticated attackers to execute arbitrary JavaScript in other users' browsers. The vulnerability affects pdfonline.foxit.com versions prior to 2026-02-03 and currently has no available patch. An attacker with valid credentials could craft a malicious username to compromise account security or steal sensitive document data from other users viewing the file list.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Pdf Editor Cloud. Foxit PDF Editor Cloud (pdfonline) contains a stored cross-site scripting vulnerability in the file upload feature. A malicious username is embedded into the upload file list without proper escaping, allowing arbitrary JavaScript execution when the list is displayed.

This issue affects pdfonline.foxit.com: before 2026‑02‑03.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.